From fd7fccabe8d1655ea986fa0f9807b34ade4f54c0 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 8 Jul 2026 19:28:23 +0200 Subject: [PATCH] tls-eap: Reject EAP Start packets from clients The Start flag should only be set in the first packet from server to client so we never should process one received from a client. --- src/libtls/tls_eap.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/libtls/tls_eap.c b/src/libtls/tls_eap.c index 7928299b6..c700a7166 100644 --- a/src/libtls/tls_eap.c +++ b/src/libtls/tls_eap.c @@ -360,6 +360,12 @@ METHOD(tls_eap_t, process, status_t, if ((this->type == EAP_PT_EAP && (pkt->flags & EAP_PT_START)) || (pkt->flags & EAP_TLS_START)) { + if (this->is_server) + { + DBG1(DBG_TLS, "received unexpected %N start from client", + eap_type_names, this->type); + return FAILED; + } if (this->type == EAP_TTLS || this->type == EAP_TNC || this->type == EAP_PEAP || this->type == EAP_PT_EAP) {